CISA warns of rising water-utility cyberattacks after Minnesota incidents
Investigators now say Iran is "probably" behind coordinated cyberattacks that targeted roughly 36 Minnesota community water systems, prompting a federal warning about rising attacks on U.S. water utilities.[1]
CISA issued an alert saying hackers have increasingly targeted programmable logic controllers used by water utilities and in some attacks changed passwords to lock out operators.[1] The FBI says utilities in about seven states reported incidents that degraded operations and identified the targeted devices as Automation/Allen-Bradley MicroLogix 1100 and 1400 series PLCs.[2] About 36 community systems were targeted, and four cities — Plymouth, South St. Paul, Maple Plain and Braham — publicly reported disruptions; Plymouth and Maple Plain later restored communications.[3]
Minnesota IT Services confirmed malicious activity at more than 30 community water systems and said authorities activated a coordinated response including MNIT, DPS, the BCA Fusion Center, MDH, MPCA, CISA, EPA and the FBI.[2] Officials said "impacted" meant evidence of malicious activity, not a statewide drinking-water safety threat, but some systems were forced offline and needed manual resets during containment and forensics.[2]
Investigative reporting moved from a tentative Iran link to a "probably" assessment as federal forensics continued, though investigators warn attribution remains preliminary.[4] Minnesota officials declined to publicly speculate on who was responsible and deferred attribution questions to federal investigators.[2]
President Donald Trump publicly rejected the emerging federal assessment and instead blamed Minnesota and Gov. Tim Walz, calling the state "grossly incompetent." FOX 9 CISA and state officials urged utilities to remove unnecessary internet access, replace default credentials, enable multifactor authentication, segregate operational networks and keep accurate offline backups.[2]
Show source details & analysis (6 sources)
📌 Key Facts
- Investigators now characterize Iran as “probably” behind the coordinated cyberattacks on roughly three dozen Minnesota water systems, while officials caution that attribution is preliminary and could be a false‑flag even as some experts view that as unlikely (investigators).
- About 36 community water systems in Minnesota were targeted over two days, an updated scope slightly above earlier "more than 30" estimates (36 community water systems).
- Four cities — Plymouth, South St. Paul, Maple Plain and Braham — publicly acknowledged disruptions, and Plymouth and Maple Plain reported restored communications with their water facilities and stabilization of services (Plymouth and Maple Plain).
- Minnesota state officials say malicious cyber activity affected more than 30 community water systems, have organized a coordinated response with agencies including Minnesota IT Services, DPS, the BCA Fusion Center, MDH, MPCA, CISA, EPA and the FBI, and have declined to publicly speculate on attribution, deferring to federal investigators (Minnesota IT Services).
- CISA has issued a fresh alert warning of a substantial rise in hackers targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems sector and reports threat actors in some cases changed passwords to lock out operators and disconnected devices from networks (CISA).
- The FBI says utilities in about seven states reported incidents that degraded water operations, and the attacks have targeted Automation/Allen‑Bradley MicroLogix 1100 and 1400 series PLCs, according to federal reporting (Automation/Allen‑Bradley MicroLogix 1100 and 1400 series PLCs).
- State and local officials emphasize that the incidents did not threaten drinking‑water safety statewide but did force some systems offline, required manual resets, and clarified that “impacted” denotes evidence of malicious activity rather than automatic loss of service or a statewide water‑use advisory (impacted).
- President Donald Trump publicly rejected the emerging federal assessment linking the attacks to Iran‑affiliated hackers and instead blamed Minnesota and Gov. Tim Walz, calling the state "grossly incompetent" (President Donald Trump).
📰 Source Timeline (6)
Follow how coverage of this story developed over time
- CISA has issued a fresh alert warning of a substantial rise in hackers targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems sector.
- CISA says threat actors have, in some cases, changed passwords to lock out operators and disconnect devices from networks at U.S. water utilities.
- FBI confirms that water and wastewater utilities in about seven states have reported incidents that affected water operations, broadening the known scope beyond Minnesota.
- Reuters, citing a New York Times report and a former senior FBI cyber official, reports that investigators see the Minnesota incidents as likely part of ongoing Iranian‑affiliated targeting of PLCs and critical‑infrastructure tech, pre‑dating the current U.S.–Iran war.
- State and local officials reiterate that Minnesota’s incidents did not threaten water safety but did force some systems offline and required manual resets.
- Minnesota IT Services confirms malicious cyber activity at more than 30 community water systems, mainly targeting remote monitoring and control tech like PLCs and HMIs.
- State lays out a coordinated response involving MNIT, DPS, BCA Fusion Center, MDH, MPCA, CISA, EPA, FBI and local utilities, emphasizing containment, forensics and restoration.
- Officials issue specific hardening guidance to water and wastewater systems: remove unnecessary internet access, replace default credentials, enable MFA, review remote-access logs, segregate OT from business networks, maintain accurate inventories and offline backups.
- FBI says at least seven states reported similar attacks that degraded water operations and identifies the targeted devices as Automation/Allen-Bradley MicroLogix 1100 and 1400 series PLCs.
- State clarifies that "impacted" means evidence of malicious activity on systems, not necessarily loss of water service, and that no statewide change in drinking-water use is currently requested.
- President Donald Trump, in a Cabinet meeting, publicly rejected the emerging federal assessment that Iran-linked hackers are behind the Minnesota water-system cyberattacks.
- Trump instead blamed "Minnesota" and Gov. Tim Walz personally, calling the state "grossly incompetent" and labeling Walz a "corrupt governor."
- FOX 9 reiterates that about 36 community water systems were targeted and that four cities — Plymouth, South St. Paul, Maple Plain, and Braham — have publicly acknowledged disruptions, while state officials continue to refuse to speculate on attribution and defer to federal investigators.
- U.S. officials told the New York Times they preliminarily suspect Iran‑affiliated hackers may be behind the attacks on Minnesota water systems.
- Those same officials also cautioned that the attribution is not confirmed and acknowledged it could be a false‑flag effort by non‑Iranian actors, though experts quoted by the Times see that as unlikely.
- FOX 9 reports the total scope as about 36 Minnesota community water systems targeted over two days, a slightly more precise figure than the earlier "more than 30" estimate.
- Plymouth and Maple Plain, which had declared disruptions and an emergency, now report restored communications with water facilities and a stabilization of services.
- State officials explicitly declined to speculate on attribution and deferred all questions about who is responsible to federal investigators.
- Investigators are now characterizing Iran as ‘probably’ behind the coordinated cyberattacks on roughly three dozen Minnesota water systems, moving beyond earlier, more tentative language about a possible Iran link.
- The article emphasizes that this ‘probable’ attribution comes from investigative assessments rather than any formal public announcement by Minnesota state agencies, underscoring a gap between what federal sources are telling media and what’s being said on the record locally.
- AlphaNews’ framing suggests investigators increasingly doubt the earlier ‘false-flag’ theory, treating direct or proxy Iranian involvement as the working assumption while the technical forensics continue.